The FBI has issued a public service announcement warning of a cyberattack technique called “OAuth consent phishing” that lets hackers access victims’ accounts without stealing a password.
The scheme has been active since late 2025 and targets prominent individuals, their family members and personal acquaintances through direct messages on commercial messaging apps, the FBI said in early September. Attackers impersonate government officials, media figures or event coordinators, then send a malicious link disguised as a file-sharing service or event invitation.
When a victim clicks the link, they land on a legitimate-looking permission screen from a real cloud provider, such as Microsoft or Google. If the victim approves the request, they unknowingly grant a malicious application full access to read and send emails and access sensitive data — without ever handing over a password.
Because the access relies on an authorization token rather than login credentials, a password reset alone does not remove it. Victims must revoke the token directly in their account security settings to cut off the attacker’s access, according to the FBI.
The FBI advises increased scrutiny of messages from unfamiliar contacts and independent verification of any sender’s identity before granting app permissions.
The American Hospital Association’s John Riggi, national advisor for cybersecurity and risk, and Scott Gee, deputy national advisor for cybersecurity and risk, are directing member hospitals to the alert as the latest in a string of 2026 advisories on social engineering tactics targeting the healthcare sector.
Becker’s 3rd Annual Fall Chief Pharmacy Officer Summit is the top tier event that the people leading the future of pharmacy convene. This 3-day event is built specifically for Chief Pharmacy Officers and senior pharmacy leaders. The sessions examine the workforce, financial and clinical priorities shaping pharmacy today. Becker’s is where candid discussions flourish and new ideas thrive. Becker's 3rd Annual Fall Chief Pharmacy Officer Summit
